Does your Network have Spam Zombies? (Part 1)

There are millions of hacked computers throughout the world; sending unwanted spam email on behalf of those pitching mortgages, gambling and male enhancement systems. Zombies are especially useful to spammers in that the allow them to bypass blacklists frequently used by anti-spam software applications.

Some of them may be on your network. At minimum, this may mean your paying extra service fees for bandwidth. Worse, your service provider could shut you down or you could end up on a blacklist. In the latter case, many business spam filtering systems would reject your email.

So, how do you tell if you have spam zombies? There are a lot of different methods utilizing different tools available. For the sake of keeping everything simple, I'm not going to assume any specific tools are available and explain everything, "from the top."

Let's take the optimistic path. Perhaps your network is entirely clean. There's an easy test which can help indicate if this is the case.

Turn all your computers on, and make sure no one is using them. If you're in a work environment, this may be best done after-hours. Now, go look at your hubs and routers. If the "traffic" lights are mostly off, you're probably in the clear. However, if you see a lot of traffic - you might have a problem.

The simple presence of unexplained network activity doesn't necessarily mean you have a zombie problem, it does mean you need to do some more research.

Most modern hubs or switches will show traffic on a per-node basis. You should be able to isolate the traffic source fairly easily. If your hub doesn't provide an indication of which ports are responsible for the traffic, it may be easiest just to walk around the office and see which PC's are showing activity on their net cards. Look for a quickly flashing LED on the back of the system.

Hopefully there's just a system or two which is the source of the network activity.

There are several things that can cause unexplained traffic besides zombies:

1. File sharing software (Kazaa, etc)
2. Legitimate network services (web servers, etc)
3. Other spyware / malware / hacking activity

Part 2 of this article will help you determine if you have a zombie, or one of the above, and how to best deal with the issue.

Back